-
Notifications
You must be signed in to change notification settings - Fork 20
Closed
Description
The error message that is triggered by too many symlink dereferences contains a non-existent path instead of the path to the symlink that causes the loop.
The path is set here:
Line 58 in b69b737
return "", &os.PathError{Op: "SecureJoin", Path: root + string(filepath.Separator) + unsafePath, Err: syscall.ELOOP} |
Steps to reproduce the issue
On Fedora CoreOS perform the following steps
mkdir ~/test
cd ~/test
- create the file Dockerfile with this contents
FROM docker.io/library/fedora:38 RUN dnf install -y golang
podman build -t go .
- create the file reproducer.go with this contents
package main import ( "os" "errors" "fmt" securejoin "github.com/cyphar/filepath-securejoin" ) func main() { path := "/root/sub" os.MkdirAll(path, 0755) target := "symlink" symlink := "/root/sub/symlink" os.Symlink(target, symlink) _, err := securejoin.SecureJoin("/root","sub/symlink") if (err != nil) { var pErr *os.PathError if errors.As(err, &pErr) { fmt.Printf("Error = %v\n", pErr.Err) fmt.Printf("Path = %v\n", pErr.Path) } } }
podman run --rm -v ./:/src:Z -w /src localhost/go go mod init reproducer
podman run --rm -v ./:/src:Z -w /src localhost/go go mod tidy
podman run --rm -v ./:/src:Z -w /src localhost/go go run .
The command printsgo: downloading github.com/cyphar/filepath-securejoin v0.2.4 Error = too many levels of symbolic links Path = /root/symlink/
Describe the results you received
At step 8 I see
Path = /root/symlink/
Describe the results you expected
At step 8 I would have expected to see
Path = /root/sub/symlink
as /root/sub/symlink is the path to the symlink that points to itself. The path /root/symlink/ does not exist.
Comment
I'm not blocked by this issue in any way. Probably this issue is of low importance.
Metadata
Metadata
Assignees
Labels
No labels